Files
playbook/antigravity-awesome-skills/.github/workflows/skill-review.yml
T
2026-07-29 07:59:17 +00:00

173 lines
7.4 KiB
YAML

name: Skill Review
on:
pull_request:
paths:
- 'skills/**'
- 'plugins/**/skills/**'
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || format('run-{0}', github.run_id) }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
review-state:
runs-on: ubuntu-latest
outputs:
configured: ${{ steps.state.outputs.configured }}
env:
TESSL_TOKEN_CONFIGURED: ${{ (secrets.TESSL_TOKEN != '' || secrets.TESSL_API_TOKEN != '') && 'true' || 'false' }}
steps:
- name: Resolve semantic review availability
id: state
run: echo "configured=${TESSL_TOKEN_CONFIGURED}" >> "$GITHUB_OUTPUT"
review-attempt:
needs: review-state
if: ${{ needs.review-state.outputs.configured == 'true' }}
runs-on: ubuntu-latest
outputs:
outcome: ${{ steps.outcome.outputs.outcome }}
env:
TESSL_REVIEW_THRESHOLD: '80'
TESSL_REVIEW_CACHE_VERSION: '2'
# Tessl workspaces are account-scoped; keep the repository variable as
# an override so a future workspace migration does not require code changes.
TESSL_WORKSPACE: ${{ vars.TESSL_WORKSPACE || 'antigravity-awesome-skills' }}
permissions:
contents: read
steps:
- name: Checkout pull request content
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.sha }}
persist-credentials: false
- name: Checkout trusted base scripts
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.base.sha }}
path: trusted-base
persist-credentials: false
- name: Fingerprint changed skill content
id: plan
run: node trusted-base/tools/scripts/review_changed_skills.cjs --plan
env:
BASE_SHA: ${{ github.event.pull_request.base.sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
- name: Restore successful Tessl review
id: review-cache
if: ${{ steps.plan.outputs.has-skills == 'true' && steps.plan.outputs.requires-manual != 'true' }}
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .tmp/tessl-review-cache
key: tessl-review-v2-${{ steps.plan.outputs.fingerprint }}
- name: Set up Tessl
if: ${{ steps.plan.outputs.has-skills == 'true' && steps.plan.outputs.requires-manual != 'true' && steps.review-cache.outputs.cache-hit != 'true' }}
uses: tesslio/setup-tessl@25ec223fc0da33b41b8044ff5ab2b85235f4f91e
with:
token: ${{ secrets.TESSL_TOKEN || secrets.TESSL_API_TOKEN }}
- name: Review changed skills
id: tessl-review
if: ${{ steps.plan.outputs.has-skills == 'true' && steps.plan.outputs.requires-manual != 'true' && steps.review-cache.outputs.cache-hit != 'true' }}
run: |
set +e
node trusted-base/tools/scripts/review_changed_skills.cjs
status=$?
set -e
if [ "$status" -eq 0 ]; then
echo "result=reviewed" >> "$GITHUB_OUTPUT"
elif [ "$status" -eq 75 ]; then
echo "result=quota" >> "$GITHUB_OUTPUT"
echo "::warning title=Tessl quota unavailable::A maintainer must review and attest to this exact head SHA before merge."
else
echo "result=manual" >> "$GITHUB_OUTPUT"
echo "::warning title=Tessl review needs maintainer judgment::Tessl did not produce a passing semantic result. A maintainer must review and attest to this exact head SHA before merge."
fi
env:
BASE_SHA: ${{ github.event.pull_request.base.sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
PR_NUMBER: ${{ github.event.pull_request.number }}
- name: Mark successful review for reuse
if: ${{ steps.tessl-review.outputs.result == 'reviewed' }}
run: |
mkdir -p .tmp/tessl-review-cache
echo "${{ steps.plan.outputs.fingerprint }}" > .tmp/tessl-review-cache/fingerprint
- name: Save successful Tessl review
if: ${{ steps.tessl-review.outputs.result == 'reviewed' }}
uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .tmp/tessl-review-cache
key: tessl-review-v2-${{ steps.plan.outputs.fingerprint }}
- name: Resolve review outcome
id: outcome
env:
CACHE_HIT: ${{ steps.review-cache.outputs.cache-hit }}
HAS_SKILLS: ${{ steps.plan.outputs.has-skills }}
REQUIRES_MANUAL: ${{ steps.plan.outputs.requires-manual }}
TESSL_RESULT: ${{ steps.tessl-review.outputs.result }}
run: |
if [ "$REQUIRES_MANUAL" = "true" ]; then
echo "outcome=manual" >> "$GITHUB_OUTPUT"
elif [ "$HAS_SKILLS" != "true" ] || [ "$CACHE_HIT" = "true" ] || [ "$TESSL_RESULT" = "reviewed" ]; then
echo "outcome=reviewed" >> "$GITHUB_OUTPUT"
elif [ "$TESSL_RESULT" = "quota" ]; then
echo "outcome=quota" >> "$GITHUB_OUTPUT"
elif [ "$TESSL_RESULT" = "manual" ]; then
echo "outcome=manual" >> "$GITHUB_OUTPUT"
else
echo "::error title=Unresolved review state::The Tessl review did not produce a trustworthy outcome."
exit 1
fi
review:
needs: [review-state, review-attempt]
if: ${{ always() && needs.review-attempt.result == 'success' && needs.review-attempt.outputs.outcome == 'reviewed' }}
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Confirm semantic review
env:
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
run: |
echo "Semantic review passed for changed skill content at ${HEAD_SHA}."
{
echo "## Skill review passed"
echo
echo "The changed skill content passed Tessl review or reused an identical previously successful review."
echo
echo "- Head SHA: \`${HEAD_SHA}\`"
} >> "$GITHUB_STEP_SUMMARY"
manual-review-required:
needs: [review-state, review-attempt]
if: ${{ always() && (needs.review-state.outputs.configured != 'true' || (needs.review-attempt.result == 'success' && needs.review-attempt.outputs.outcome != 'reviewed')) }}
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Record exact head requiring maintainer review
env:
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
REVIEW_OUTCOME: ${{ needs.review-attempt.outputs.outcome }}
run: |
if [ "$REVIEW_OUTCOME" = "quota" ]; then
reason="the Tessl credit quota is unavailable"
elif [ "$REVIEW_OUTCOME" = "manual" ]; then
reason="Tessl did not produce a passing semantic result"
else
reason="Tessl credentials are unavailable"
fi
echo "::warning title=Manual skill review required::Semantic review is unavailable because ${reason}. A maintainer must attest to the exact head SHA before merge: ${HEAD_SHA}."
{
echo "## Manual skill review required"
echo
echo "- Head SHA: \`${HEAD_SHA}\`"
echo "- Reason: ${reason}."
} >> "$GITHUB_STEP_SUMMARY"